vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2020-13949

HIGH
7.5
CVSS Score
Published: February 12, 2021 at 07:39 PM UTC
Updated: June 17, 2026 at 02:53 AM UTC
4 products affected across 2 vendorsCommunications Cloud Native Core PolicyThriftCommunications Cloud Native Core Network Slice Selection Function

Using Apache Thrift by N/A?

Get instant alerts when new vulnerabilities affect Apache Thrift - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 7%

Description

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Hive· Apachemaven
95%
v < 4.0.0
Affected range stops below 4.0.0, so it looks safe — our inference, not a vendor statement
Thrift· Apachepypi
95%
v ≤ 0.13.00.9.3 ≤ v ≤ 0.13.0
Communications Cloud Native Core Network Slice Selection Function· Oracle
95%
1.2.1
Communications Cloud Native Core Policy· Oracle
95%
1.14.0

References (108)

Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r01b34416677f1ba869525e1b891ac66fa6f88c024ee4d7cdea6b456b%40%3Cissues.hbase.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r02ba8db500d15a5949e9a7742815438002ba1cf1b361bdda52ed40ca%40%3Cissues.hbase.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r02f7771863383ae993eb83cdfb70c3cb65a355c913242c850f61f1b8%40%3Cissues.hbase.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r0372f0af2dad0b76fbd7a6cfdaad29d50384ad48dda475a5026ff9a3%40%3Cissues.hbase.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r08a7bd19470ef8950d58cc9d9e7b02bc69c43f56c601989a7729cce5%40%3Cissues.hbase.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r1084a911dff90b2733b442ee0f5929d19b168035d447f2d25f534fe4%40%3Cissues.solr.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r117d5d2b08d505b69558a2a31b0a1cf8990cd0385060b147e70e76a9%40%3Cissues.hbase.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r12090c81b67d21a814de6cf54428934a5e5613fde222759bbb05e99b%40%3Cissues.hive.apache.org%3E

CVSS

7.5HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-400

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card